Apple on Monday released iOS and macOS updates to patch a zero-day vulnerability that may have been exploited in targeted attacks.
The flaw, tracked as CVE-2026-86950, is an out-of-bounds write issue in the CoreGraphics component that can be exploited for arbitrary code execution when it processes a specially crafted file.
Apple has not said how the malicious file is delivered, but because CoreGraphics handles 2D graphics and PDF rendering across the operating system, it could arrive via web pages, email attachments, or messaging apps, where automatic attachment and link previews could enable zero-click exploitation.
“Apple is aware of a report that this issue may have been exploited in an extremely sophisticated attack against specific targeted individuals on versions of iOS before iOS 27,” Apple said in its advisory.
No information has been shared on the attacks exploiting CVE-2026-86950, but Apple noted that it learned about the vulnerability from Meta’s product security team.
Meta’s involvement is noteworthy given a similar incident from last year, when WhatsApp said a vulnerability in its iOS and macOS apps (CVE-2025-55177) was likely used alongside the Apple ImageIO zero-day CVE-2025-43300 in zero-click attacks aimed at fewer than 200 users.
It’s unclear whether the newly patched CoreGraphics flaw was exploited through WhatsApp. SecurityWeek has reached out to Meta for clarification and will update this article if the company responds.
CVE-2026-86950 has been patched with the release of iOS 26.7.1, iPadOS 26.7.1, macOS Tahoe 26.7.1, and macOS Sequoia 15.8.1.
While both iOS and macOS are impacted, Apple’s advisory suggests that attacks have only been observed against the former. The latest iOS 27 and macOS Golden Gate 27 do not appear to be affected.
CISA has yet to add CVE-2026-86950 to its KEV catalog. This would be the ninth Apple product flaw added to the catalog this year.
Related: Apple Patches 87 Vulnerabilities in iOS, 155 in macOS Tahoe
Related: Apple Patches Dozens of Vulnerabilities Across iOS, macOS, and Safari
Related: Citrix Confirms 2 NetScaler Zero-Days After Admins Pulled the Plug